Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Curve Finance Malicious Code Injection Attack: $428.00K Reported Loss

·Historical incident record

Incident Overview

The Curve Finance frontend was attacked, prompting users to grant token approvals to malicious smart contracts. The attackers moved the stolen funds to FixedFloat and Tornado Cash, with at least 362 ETH (~$620,000) stolen. FixedFloat tweeted that they had frozen 112 stolen ETH (~$192,000).

Sources & References

Original incident referencehttps://twitter.com/CurveFinance/status/1557107088962224132 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodGovernance Attack
    Reported loss$ 30,000,000
  2. Incident date
    Attack methodAffected by Vyper Vulnerability
    Reported loss$ 25,123,594
  3. Incident date
    Attack methodContract Vulnerability
    Reported lossNot disclosed
  4. Incident date
    Attack methodRug Pull
    Reported loss$ 600,000
  5. Incident date
    Attack methodPrice Manipulation
    Reported loss36,000 BUSD